Bug 707448: Fix text moving after redaction.

PDF text can (broadly) either be placed using:

 (foo) Tj

or

 [ (foo) 10 (bar) ] TJ

We were adjusting for removed text within a string in the wrong
sense when using the former. This was non-obvious, because the
numbers given in the array in the latter are SUBTRACTED rather
than added to the position, so they are implicitly negated.

Here we recast the code slightly so that the adjustments are made
the same way in either method, and we explicitly negate the
values before writing them to the array.

source/pdf/pdf-op-filter.c

@@ -874,7 +874,8 @@ push_adjustment_to_array(fz_context *ctx, pdf_sanitize_processor *p, pdf_obj *ar
 {
 	if (p->Tm_adjust == 0)
 		return;
-	pdf_array_push_real(ctx, arr, p->Tm_adjust * 1000);
+	/* Negate the number here, because it will be subtracted upon use. */
+	pdf_array_push_real(ctx, arr, -p->Tm_adjust * 1000);
 	p->Tm_adjust = 0;
 }
 
@@ -905,7 +906,7 @@ filter_show_string(fz_context *ctx, pdf_sanitize_processor *p, unsigned char *bu
 		}
 		if (i != len)
 		{
-			adjust_text(ctx, p, p->tos.char_tx, p->tos.char_ty);
+			adjust_text(ctx, p, -p->tos.char_tx, -p->tos.char_ty);
 			i += inc;
 		}
 		if (removed_space)
@@ -962,7 +963,7 @@ filter_show_text(fz_context *ctx, pdf_sanitize_processor *p, pdf_obj *text)
 					}
 					if (j != len)
 					{
-						adjust_text(ctx, p, p->tos.char_tx, p->tos.char_ty);
+						adjust_text(ctx, p, -p->tos.char_tx, -p->tos.char_ty);
 						j += inc;
 					}
 					if (removed_space)
@@ -971,7 +972,7 @@ filter_show_text(fz_context *ctx, pdf_sanitize_processor *p, pdf_obj *text)
 			}
 			else
 			{
-				float tadj = - pdf_to_real(ctx, item) * gstate->pending.text.size * 0.001f;
+				float tadj = pdf_to_real(ctx, item) * gstate->pending.text.size * 0.001f;
 				if (fontdesc->wmode == 0)
 				{
 					adjust_text(ctx, p, tadj, 0);